Why can’t FTK display some files in a physical DD image from an Apple device?

All devices that shipped with or were restored to iOS 4+ encrypt the majority of their data. Because of this, you may not be able to view the contents of some files in FTK unless your images were created with MPE+ 4.7 or later (to obtain the decryption keys) and you are using FTK 4.0.2 or later. An alternative to getting these physical DD images would be to get the deep logical TAR images, which are not encrypted.